hxxps://ccm[.]net/downloads/video-games/8715-forza-horizon-5/?n=&version=windows

Analysis

max time kernel
1049s
max time network
1052s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ccm.net/downloads/video-games/8715-forza-horizon-5/?n=&version=windows

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
6076	Forza-Horizon-5-Windows-3-563-816-0-en.exe
3432	gameinputsvc.exe
1448	gameinputsvc.exe
6512	Forza-Horizon-5-Windows-3-563-816-0-en.exe
3880	Forza-Horizon-5-Windows-3-563-816-0-en.exe
428	Forza-Horizon-5-Windows-3-563-816-0-en.exe
6380	Forza-Horizon-5-Windows-3-563-816-0-en.exe
4184	Forza-Horizon-5-Windows-3-563-816-0-en.exe
5180	Forza-Horizon-5-Windows-3-563-816-0-en.exe

Loads dropped DLL 4 IoCs

pid	Process
1448	gameinputsvc.exe
60	Process not Found
6412	XboxPcApp.exe
6588	XboxPcApp.exe

Registers COM server for autorun 1 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ = "C:\\Program Files\\WindowsApps\\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\\InstallServicePlugin.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ = "C:\\Windows\\system32\\GamingServicesProxy.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ = "C:\\Windows\\system32\\GamingServicesProxy.dll"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32\ = "C:\\Windows\\system32\\GamingServicesProxy.dll"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}\InProcServer32	GamingServices.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	GamingServices.exe
File opened (read-only)	\??\I:	GamingServices.exe
File opened (read-only)	\??\A:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\J:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\X:	GamingServices.exe
File opened (read-only)	\??\Y:	GamingServices.exe
File opened (read-only)	\??\M:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	GamingServices.exe
File opened (read-only)	\??\M:	GamingServices.exe
File opened (read-only)	\??\X:	GamingServices.exe
File opened (read-only)	\??\R:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	GamingServices.exe
File opened (read-only)	\??\B:	GamingServices.exe
File opened (read-only)	\??\E:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\O:	GamingServices.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	GamingServices.exe
File opened (read-only)	\??\R:	GamingServices.exe
File opened (read-only)	\??\U:	GamingServices.exe
File opened (read-only)	\??\V:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\Y:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\H:	GamingServices.exe
File opened (read-only)	\??\K:	GamingServices.exe
File opened (read-only)	\??\Z:	GamingServices.exe
File opened (read-only)	\??\X:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\A:	GamingServices.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	GamingServices.exe
File opened (read-only)	\??\G:	GamingServices.exe
File opened (read-only)	\??\N:	GamingServices.exe
File opened (read-only)	\??\G:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\Q:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\W:	GamingServices.exe
File opened (read-only)	\??\J:	GamingServices.exe
File opened (read-only)	\??\R:	GamingServices.exe
File opened (read-only)	\??\T:	GamingServices.exe
File opened (read-only)	\??\W:	GamingServices.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	GamingServices.exe
File opened (read-only)	\??\W:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\L:	GamingServices.exe
File opened (read-only)	\??\U:	GamingServices.exe
File opened (read-only)	\??\I:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\T:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\P:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	GamingServices.exe
File opened (read-only)	\??\N:	GamingServices.exe
File opened (read-only)	\??\K:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\O:	Forza-Horizon-5-Windows-3-563-816-0-en.exe
File opened (read-only)	\??\O:	GamingServices.exe
File opened (read-only)	\??\Q:	GamingServices.exe
File opened (read-only)	\??\S:	GamingServices.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{149847CD-38EA-4DD5-BF95-4A6165D4263F}.checkpoint	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}\SETA4FD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}\SETA4FC.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File created	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xvdd.inf_amd64_45f35b192221e9ae\xvdd.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}	DrvInst.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FFA97DEA-FF83-4A5B-BDA1-8DFF0A20237B}.checkpoint	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\xvdd.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\SET9F21.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e68a2a4f-d92f-b44a-a1a4-b1c6e50b6431}\SETBBF0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\gamingservicesproxy.dll	GamingServices.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6FE3DFCE-FAB9-4181-BD76-0F2BB014AC3D}.catalogItem	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\SET9F00.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xvdd.inf_amd64_45f35b192221e9ae\xvdd.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9696F0D7-1BA2-49E6-856F-C7564519711E}.checkpoint	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3BE8B6AA-4348-4607-8A6B-CF54AA408ABF}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7F50B048-3D25-4BBC-BD09-B1241E6D69C2}.checkpoint	svchost.exe
File created	C:\Windows\system32\gameplatformservices.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{10B91BEF-2EF2-4D97-87B5-A0C853067EAA}.checkpoint	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{83D0C94A-3740-4CAF-8ECD-8607C17E0249}.checkpoint	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c802ee65-e4b5-fe42-b57b-0508433fa3a0}\SET69B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf	DrvInst.exe
File created	C:\Windows\system32\gameplatformservices.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FFA97DEA-FF83-4A5B-BDA1-8DFF0A20237B}.checkpoint	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7F50B048-3D25-4BBC-BD09-B1241E6D69C2}.checkpoint	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{83D0C94A-3740-4CAF-8ECD-8607C17E0249}.checkpoint	svchost.exe
File created	C:\Windows\system32\gameplatformservices.dll	GamingServices.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{17087158-D217-4A98-A72C-FEB618AB10B9}.catalogItem	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e68a2a4f-d92f-b44a-a1a4-b1c6e50b6431}\SETBBF1.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{149847CD-38EA-4DD5-BF95-4A6165D4263F}.checkpoint	svchost.exe
File opened for modification	C:\Windows\system32\GameInputRedist.dll	gameinputsvc.exe
File created	C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}\SETA50D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}\SETA4FD.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\gamelaunchhelper.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\xvdd.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.sys	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1DF932C4-673F-4926-90B2-F9C2A1EEAE8B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B29D1963-4EAC-473E-9103-8628524DBAF5}.checkpoint	svchost.exe
File created	C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\SET9F21.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e68a2a4f-d92f-b44a-a1a4-b1c6e50b6431}\gameflt.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e68a2a4f-d92f-b44a-a1a4-b1c6e50b6431}\SETBBF2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.cat	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DDF319EB-80A6-458C-B404-B5DD5CF005D6}.catalogItem	svchost.exe
File created	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{73010109-1C1D-4A14-B6E1-949EA669C3F6}.checkpoint	svchost.exe
File opened for modification	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{08AAF1EC-40CF-43B5-B072-2360EE2FC559}.catalogItem	svchost.exe
File opened for modification	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c802ee65-e4b5-fe42-b57b-0508433fa3a0}\SET69D.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B29D1963-4EAC-473E-9103-8628524DBAF5}.checkpoint	svchost.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft GameInput\x86\gameinput.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x86\gameinputredist.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Kits\10\Catalogs\catded785c75b3d3adeef26e53fee6beba8.cat	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x64\gameinput.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x64\gameinputredist.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows Kits\10\Catalogs\catbfd5519c2b57eb0ee9fe1d5b706a7b44.cat	msiexec.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\e5a9145.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F2B6AF3-C260-8666-5950-E3FEDBC851D6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9656.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File created	C:\Windows\Installer\e5a9149.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e5a9145.msi	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	gameinputsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	gameinputsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XboxPcApp.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XboxPcApp.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XboxPcApp.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XboxPcApp.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XboxPcApp.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XboxPcApp.exe

Enumerates system info in registry 2 TTPs 29 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	XboxPcApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XboxPcApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XboxPcApp.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{BAEE68FB-2B54-4DE3-BECC-4FF62E89ABAF}	GamingServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	gameinputsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C00A9F8BC407 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000035f0e80f1f526a428c3758d51027ef2900000000020000000000106600000001000020000000c6ab6253d283efa297572c906cbbf0d225e46778c84983e34a6c49e1e36b7ced000000000e800000000200002000000013f8967a4dac7b28530282d66f93f1dee5e3d0be08f381e4a57185177c75664080000000c68b601b6c3ddb01562886b74feda208033b6c9a465f686963e3b910fe42acae3f366e5d5e77c1c2bbc1d1b2fd3e59fc011ac936a734725b0c5fc0468e821260bb9e924b2ce1911620b3d31621d664bda9f3b1f6519527b37460904da98145acf6fecf1027fb047585325b65a2137d25549682907b7217c474501eb172165a7c40000000e05e00435aadc6c97ebf5c00502d9ea2b650ee3449bb528a5dd1ad763a18856753c4d345bba1c6bb7e95e836af88cf55c7573a74eed45907a5cd1e281f1170d5	GamingServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	gameinputsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2bee07d0-da2e-459e-b30c-0399c285e809}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3a842a27-fd86-40be-8fa8-483a86ae011c}\ = "IUsersClient"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C9F4E14-D619-4905-8EBD-A0033A4FF485}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E652A68A-88A2-45BF-8D2E-7404278C7F8A}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D9DE7D3-6ABD-4EA5-BB47-D78E1C22DC91}\ = "IEnumPackageLaunchIdentifier"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04A4A9D1-8881-4E18-96CF-184E58A2323C}\ = "IGamePlatformTestService"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE51CF4F-D657-41C0-AC3B-7218A32CA524}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.gamingapp_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	XboxPcApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8C956A7-D22F-461A-857C-89FB1F9C378B}\ = "XGameSaveEnumerator"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7329866-C529-4493-9FE8-CAAFE0EEDFFD}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4D2BF08-1409-4918-9D84-32EE00E9178C}\ = "AsyncIXGameSaveReadHandler"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC9DC3BC-6685-4005-B961-A6B53B75A12D}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{903de535-e51b-48d3-b30c-33f95f2bf1bc}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4a32d79e-b19a-4e6b-a620-ed9c71468ce1}\ = "IUsersSkuSpecificServer"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4D2BF08-1409-4918-9D84-32EE00E9178C}\SynchronousInterface	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8B9BA5-D030-44F8-819E-EA04BE3CC9C8}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4C1344D-55A0-453A-957E-83727B36CAC9}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A9D8E03-A524-4FC6-A566-2BC802898DFF}\AsynchronousInterface	GamingServices.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{671D365D-D1F9-4B8A-BA89-832EB0CFF5F5}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{090795DB-989B-4625-B397-083D85066042}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C30D27D6-20E1-4E42-87E1-6BE72E5F1388}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6AF7-8620-4B0E-A9B1-4CA958B8A24D}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2964DB41-BAE4-4996-A0A0-D036BFFDC267}\LaunchPermission = 010014806400000070000000140000003000000002001c000100000011001400040000000101000000000010001000000200340002000000000018000b000000010200000000000f0200000001000000000014000b00000001010000000000010000000001010000000000050a00000001020000000000052000000021020000	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EA477743-75BC-472B-84ED-275E0D70F423}\LocalService = "GamingServices"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c4ffeb73-c9fc-44f1-930b-ad0254e8270f}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EA477743-75BC-472B-84ED-275E0D70F423}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82B0290F-C7F3-466C-BF99-49FD29CA5C92}\ = "IGameCorePackageServiceMonitor_V1"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{276d243c-db6c-47e9-8e21-ae51d4c3dfd4}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A9D8E03-A524-4FC6-A566-2BC802898DFF}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FBA5170-10C4-4185-89E3-2D8389223563}\InProcServer32\ThreadingModel = "Both"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A1770C0-750A-4346-9035-221F4C79CB23}\ = "IEnumGamePlatformPackageFeatures"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A235E9E0-D5B8-43F3-AB73-02EFC93E2D2C}\ = "IEnumGamePlatformPackageUpdates"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F29BCE54-1E43-48E0-AC77-382337B080C7}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1FEC1B52-5B90-4316-B6B2-CBEEE255C3D7}\ = "IGamePlatformXRuntimeServer"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a88bbde8-607c-507e-8b2f-ff422ef2c8a7}	GamingServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.gamingapp_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	XboxPcApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C9F4E14-D619-4905-8EBD-A0033A4FF485}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{142C8431-D185-4F3E-8886-139BFD3430BB}\ = "IXGameSaveBlobNameQuery"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A54D7505-C0B4-4B6C-9060-41D7D67B40EB}\ = "IPackageLaunchIdentifier"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E3E0D16-554A-4654-832E-C9ACD84DE0EB}\ = "IGamePlatformStoreService"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB48C4B7-2ADA-438F-A9CA-E6ACC3838C4B}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C0947C0-A113-47D8-ACC2-1F3FB425EA88}\ = "IEnumGamePlatformPackageExecutables"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C67882B9-127A-4D99-A424-EAE92313BBD5}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{276d243c-db6c-47e9-8e21-ae51d4c3dfd4}\ = "IUsersSkuSpecificServer2"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FF525D5-AC7F-4D25-8CEC-23686C02A7C9}\ = "ApplicationLicenseManager"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6FF479-E54E-4786-AC2A-10D35C5B93A7}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{142C8431-D185-4F3E-8886-139BFD3430BB}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7819FFCA-EFF3-45AD-B95A-810DADD84AAB}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E39C6C9C-44CF-435C-BF7B-5D524512791A}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8f297125-1be1-5983-aa61-3f675f53e973}\ = "Windows.Foundation.AsyncOperationCompletedHandler`1<GameCore.Users.DenyReason>"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CD4BEF6-AEB3-41D7-ABBC-61C35CCBD4AD}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FA6B2F1062C666895053EEFBD8C156D\ProductName = "Microsoft GameInput"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F4C14F1-68A8-4DAC-93CA-AC4BD6A2F91C}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87044ed6-fa31-4be8-b8d5-b181c7210351}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5FB9AC1-AD68-45C5-B7EB-6F2498AEFAA7}\LocalService = "GamingServices"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C54E80C6-8A29-4CE4-B259-630F735CF8B6}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25209EC2-1BAD-45AB-AC18-42396DF52294}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FF525D5-AC7F-4D25-8CEC-23686C02A7C9}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBF8959-5F3F-408B-9A60-436F5E97A46A}\ = "IEnumGamePlatformPackageRecipes"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D271B28B-505C-406F-BCC8-46CABB249E2E}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44564d39-2e0e-46c5-acd4-c24260c440f6}\ProxyStubClsid32\ = "{25209EC2-1BAD-45AB-AC18-42396DF52294}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5FB9AC1-AD68-45C5-B7EB-6F2498AEFAA7}\ = "GameCoreLicenseService"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13A35C28-08C9-4805-9E85-D7ED759314F9}\ = "IXboxDeployment"	GamingServices.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\MuiCache	XboxPcApp.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 506638.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
4608	msedge.exe
4608	msedge.exe
3756	identity_helper.exe
3756	identity_helper.exe
3028	msedge.exe
3028	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
6432	msiexec.exe
6432	msiexec.exe
1448	gameinputsvc.exe
1448	gameinputsvc.exe
5616	GamingServices.exe
5616	GamingServices.exe
2040	XboxPcApp.exe
2040	XboxPcApp.exe
5184	XboxAppServices.exe
5184	XboxAppServices.exe
2040	XboxPcApp.exe
2040	XboxPcApp.exe
2136	XboxPcApp.exe
2136	XboxPcApp.exe
2136	XboxPcApp.exe
2136	XboxPcApp.exe
4460	XboxPcApp.exe
4460	XboxPcApp.exe
4460	XboxPcApp.exe
4460	XboxPcApp.exe
3484	XboxPcApp.exe
3484	XboxPcApp.exe
3484	XboxPcApp.exe
3484	XboxPcApp.exe
6412	XboxPcApp.exe
6412	XboxPcApp.exe
6412	XboxPcApp.exe
6412	XboxPcApp.exe
6416	GamingServices.exe
6416	GamingServices.exe
6588	XboxPcApp.exe
6588	XboxPcApp.exe
6588	XboxPcApp.exe
6588	XboxPcApp.exe
1848	GamingServices.exe
1848	GamingServices.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
832	PickerHost.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3032	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3032	AUDIODG.EXE
Token: SeShutdownPrivilege	6076	Forza-Horizon-5-Windows-3-563-816-0-en.exe
Token: SeCreatePagefilePrivilege	6076	Forza-Horizon-5-Windows-3-563-816-0-en.exe
Token: SeManageVolumePrivilege	3140	svchost.exe
Token: SeShutdownPrivilege	1300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1300	msiexec.exe
Token: SeSecurityPrivilege	6432	msiexec.exe
Token: SeCreateTokenPrivilege	1300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1300	msiexec.exe
Token: SeLockMemoryPrivilege	1300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1300	msiexec.exe
Token: SeMachineAccountPrivilege	1300	msiexec.exe
Token: SeTcbPrivilege	1300	msiexec.exe
Token: SeSecurityPrivilege	1300	msiexec.exe
Token: SeTakeOwnershipPrivilege	1300	msiexec.exe
Token: SeLoadDriverPrivilege	1300	msiexec.exe
Token: SeSystemProfilePrivilege	1300	msiexec.exe
Token: SeSystemtimePrivilege	1300	msiexec.exe
Token: SeProfSingleProcessPrivilege	1300	msiexec.exe
Token: SeIncBasePriorityPrivilege	1300	msiexec.exe
Token: SeCreatePagefilePrivilege	1300	msiexec.exe
Token: SeCreatePermanentPrivilege	1300	msiexec.exe
Token: SeBackupPrivilege	1300	msiexec.exe
Token: SeRestorePrivilege	1300	msiexec.exe
Token: SeShutdownPrivilege	1300	msiexec.exe
Token: SeDebugPrivilege	1300	msiexec.exe
Token: SeAuditPrivilege	1300	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1300	msiexec.exe
Token: SeChangeNotifyPrivilege	1300	msiexec.exe
Token: SeRemoteShutdownPrivilege	1300	msiexec.exe
Token: SeUndockPrivilege	1300	msiexec.exe
Token: SeSyncAgentPrivilege	1300	msiexec.exe
Token: SeEnableDelegationPrivilege	1300	msiexec.exe
Token: SeManageVolumePrivilege	1300	msiexec.exe
Token: SeImpersonatePrivilege	1300	msiexec.exe
Token: SeCreateGlobalPrivilege	1300	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeTcbPrivilege	3432	gameinputsvc.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe
Token: SeRestorePrivilege	6432	msiexec.exe
Token: SeTakeOwnershipPrivilege	6432	msiexec.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
6076	Forza-Horizon-5-Windows-3-563-816-0-en.exe
5184	XboxAppServices.exe
5184	XboxAppServices.exe
6416	GamingServices.exe
6416	GamingServices.exe
1848	GamingServices.exe
1848	GamingServices.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
5184	XboxAppServices.exe
5184	XboxAppServices.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2040	XboxPcApp.exe
2136	XboxPcApp.exe
4460	XboxPcApp.exe
3484	XboxPcApp.exe
6412	XboxPcApp.exe
832	PickerHost.exe
6588	XboxPcApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2336	4608	msedge.exe	66
PID 4608 wrote to memory of 2336	4608	msedge.exe	66
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 3252	4608	msedge.exe	87
PID 4608 wrote to memory of 1060	4608	msedge.exe	86
PID 4608 wrote to memory of 1060	4608	msedge.exe	86
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88
PID 4608 wrote to memory of 4136	4608	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ccm.net/downloads/video-games/8715-forza-horizon-5/?n=&version=windows
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1cba46f8,0x7ffd1cba4708,0x7ffd1cba4718
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7664 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8228 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:3028
- C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe
  "C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8952 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:6220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8816 /prefetch:1
  2⤵
  PID:6212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8820 /prefetch:1
  2⤵
  PID:6204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:7120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9888 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9512 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1416 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,339000660875071535,2066717477945832876,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe
  "C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe"
  2⤵
  - Executes dropped EXE
  PID:6512
- C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe
  "C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe"
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe
  "C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe"
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe
  "C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe"
  2⤵
  - Executes dropped EXE
  PID:6380
- C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe
  "C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe"
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe
  "C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe"
  2⤵
  - Executes dropped EXE
  PID:5180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:6848
- C:\Windows\system32\svchost.exe
  "svchost.exe"
  2⤵
  PID:7108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6272

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.XboxIdentityProvider_8wekyb3d8bbwe
1⤵
PID:6212

C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5616
- C:\Windows\system32\msiexec.exe
  C:\Windows\system32\msiexec.exe /i "C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\gameinputredist.msi" /quiet /l*v "C:\Windows\TEMP\gameinputredist.log"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1300

C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe"
1⤵
PID:6556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6432

C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
"C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3432
- C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
  "C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2960
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{1ca3b0e7-42db-7446-8ca4-514c8bf81331}\xvdd.inf" "9" "4e7a111df" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000148" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:6072
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "SWD\XvddEnum\XvddRootDevice_Instance" "" "" "48fe919b3" "0000000000000000"
  2⤵
  - Drops file in Windows directory
  PID:5840
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{fca8b498-6864-b847-9546-4a85ee7d97e8}\gameflt.inf" "9" "42e40eeeb" "0000000000000158" "Service-0x0-3e7$\Default" "0000000000000170" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:6780
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf" "0" "42e40eeeb" "0000000000000170" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:3248
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf" "0" "4100319eb" "0000000000000140" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1084

C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe
"C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe" -ServerName:Microsoft.Xbox.App.AppXqq7rzt1gkb5kpcpszh37b7p6x61mdkks.mca
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxAppServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxAppServices.exe" -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5184

C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe
"C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe" -ServerName:Microsoft.Xbox.App.AppXqq7rzt1gkb5kpcpszh37b7p6x61mdkks.mca
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2136

C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe
"C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe" -ServerName:Microsoft.Xbox.App.AppXqq7rzt1gkb5kpcpszh37b7p6x61mdkks.mca
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4460

C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe
"C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe" -ServerName:Microsoft.Xbox.App.AppXqq7rzt1gkb5kpcpszh37b7p6x61mdkks.mca
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3484

C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe
"C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe" -ServerName:Microsoft.Xbox.App.AppXqq7rzt1gkb5kpcpszh37b7p6x61mdkks.mca
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6412

C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:6416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5044
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{0cdd3caf-bdbd-154b-a0ad-6c46ec02f301}\gameflt.inf" "9" "42e40eeeb" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf" "0" "42e40eeeb" "0000000000000158" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:5548
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf" "0" "4100319eb" "0000000000000148" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5256
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{8bc5a286-f65a-024b-82a1-b921507e62d7}\gameflt.inf" "9" "42e40eeeb" "0000000000000158" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:6292
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf" "0" "42e40eeeb" "0000000000000174" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:3768
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf" "0" "4100319eb" "0000000000000158" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3584

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:832

C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe
"C:\Program Files\WindowsApps\Microsoft.GamingApp_2306.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe" -ServerName:Microsoft.Xbox.App.AppXqq7rzt1gkb5kpcpszh37b7p6x61mdkks.mca
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6588

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.XboxIdentityProvider_8wekyb3d8bbwe
1⤵
PID:6392

C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_13.78.12002.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5a9148.rbs

Filesize
12KB

MD5
ac6b342f423b227e2700868128f041b4

SHA1
5232f9acd2d5ce713fd4b952da95f187ff569e6a

SHA256
2e7fcceb49ea03f9985adf0b573c9a7203d108cef974452e76a36665a97215bb

SHA512
113de1a2c0a0110218599b84e2b8fa4e6403a671c6177a4a5769b2f7504010cf3746fd3016bd6a8d8dbae2e0aab32b824148c5bf1befd5c1c89eaaf884506e7d

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x64\GameInputRedist.dll

Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe

Filesize
89KB

MD5
efbb63a705d505ffbd154cc443054574

SHA1
ec0ce2f04e3288a2f1e43f5ce2fb2195ea5b7ffd

SHA256
858ecbeda0f6ed2722435c7f4847a323f872982ce6f1ab7fe861738344062d3e

SHA512
b2675772157766d68c0dcfab31bb7bba7a68da840f37cd36afe3309588f46b4ef4f8d1da322097c9a053f6133d7397b1aac80dfcb6a6693e0e070c87e7503d03

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe

Filesize
89KB

MD5
efbb63a705d505ffbd154cc443054574

SHA1
ec0ce2f04e3288a2f1e43f5ce2fb2195ea5b7ffd

SHA256
858ecbeda0f6ed2722435c7f4847a323f872982ce6f1ab7fe861738344062d3e

SHA512
b2675772157766d68c0dcfab31bb7bba7a68da840f37cd36afe3309588f46b4ef4f8d1da322097c9a053f6133d7397b1aac80dfcb6a6693e0e070c87e7503d03

Download Submit
C:\Program Files (x86)\Microsoft GameInput\x86\GameInputRedist.dll

Filesize
236KB

MD5
c6b900b9dca17d44dca701a65a96dda0

SHA1
d4a6f237fe61a6558e0c9ce9af069f479794389d

SHA256
dad5d0a672bd9a217efb1be8c6c3acf342ebd82e0f7b403359944aed8e624475

SHA512
35413114afea11e4675b1f68c4f0485b65038f64457d7bc9e6b1883a030e94b275dc96abdbdf0b9f8736299998e719c1d15d41d78f65fb33b9cb505679de57a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
55KB

MD5
fba312478200b967723bf53e7f3defd6

SHA1
9ca9337ef4ead1686095143032f5fc6de54f207a

SHA256
28aa216fa4a1167ddaabd4cf981c541cfd3873cef069ed59a63f54b333af9769

SHA512
6e16c58cfa6381c30e26fbf17e61b64861c166280f0bfa2edbb85488e8cfe5ed56d34472be9fba10628a143eb9bc720db7d33f83e84a492bea9c8af3be4d5fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a57691fc73dd1f350a7bd78978508407

SHA1
87df617731bf85214fc26bbb80a5b1ac5c748321

SHA256
8d9e0a51ef919d3d193e82967cbbbd590635994f6ab3f57c76f0953506b55704

SHA512
fc80cbb5db2df08a670679a4e82ec4c5d7df6e7535bf37e94a03d9d48c37cd1b29669abaf61cce868468b5e8d41940578b8c92c62b48aabc384270b2851a3535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
3c158fa9536670dad8a2cc2f29ef4fdc

SHA1
afec639bfeaa4e1302224784828cfb46e97f9998

SHA256
1b6d1831f77ff52ca1167892856b0a859f70114eb0601a5e60891e6438f49b3a

SHA512
ab5397adbafa25c4d47f2f3c98f57dd43e646699982a6f7eef3c1673e118078bf7623bd8108267759073c6ca0bdf3bde653330c579d42c3bfcb7a86a3af613d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
5d4f40277910f580d9e89da93f76cd54

SHA1
5618bf622a332bd38c14f733af323d9e7edc91fb

SHA256
d3f711163dd882656fbfcd01d95fbb14a7d3e5088792d68e77dee7a0827bbd86

SHA512
332c0c874d47393437ff214963c7b82cf8c441b9b41fee549ffaac041972edb0189d68809780fb69e747f6a602f82bbd914cfb0e10f7776896eb9c32e6f078d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
468f9cd40f89aa5f0bf88cad81debbd6

SHA1
44fd1313e24234253ffc5f0a1847710fe0017976

SHA256
ca491034982bfaeb477e84e837da862d73277c2d957d9f0d846612cba0933d2a

SHA512
a0c88fbd12fecdd9ebb7166e3784d736f34d38dd5b8a12a982905b1c7b3c33e314e03bfc53eefd6dd4fdbd909e90551e8a7795fea365c8232601048af129fef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d85273ffc1b68b1b02ab48cdab957b3

SHA1
88310a5cbc8c1824f10ba0be301ff38638d00085

SHA256
fb8305a54e80bec36b61135ef74048aa36ae4465ac3c0e2b0f4f4ca747631aad

SHA512
533de7a24c51697e430379a75da3de62e7f7d6ddd263fda7068f183e8f1d6d6d293cd0ecef70da9140d8d58144229525f1cc44df03af6e844efc581277f02f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
fd61a62324c25833650d24f403d6da05

SHA1
f6435ab21a76e5927e9213da7173fe47d6165a42

SHA256
d318b61ebdb40a68c37a541e816845906630cfcdefb56bd38efa35677a4dd438

SHA512
42ef3f40e513ee145360dfec5a3faab64713eec255574e8763aa0bb3502d5eccef7961d3d07979e25952945933434b6bec7db00082514c9b16b237ecd2fea746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cb8591a74019fb3f9b655956be699ee5

SHA1
edd78b5fef884aebfd7d74dfbd84a47795105539

SHA256
85ffa7729e114bd5a992b3572fa9d110832006fc18abe1d9b930f6e529f6a9f9

SHA512
ed09b93094cb8d51545502e84ee3da770ba4cdbb3f8772b0bbd2e251b5c3879c423d099636282927f864f0bb962f09e5553bf61046d5783e8daebc84a32b7312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b9e8b700d94471f03923abfdeae18734

SHA1
b424944f1791010f3f49bd1a28e3bc193e8574f2

SHA256
517d38e48838a25eb05c48c5cf7d12109c9698e7fd889cec5690743832b67e65

SHA512
92a08f26657d6a9df03d862df0dc4d2753ba25e22033b4ffc6264538efc430dbcda65da96604e3fbee4d33ff5a66a53fca14f3e8348297593ed0e2817b2090ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b6f42a2b1fc6153e92c74c093a58cc20

SHA1
530f39a3bbfbe66cc350884c3bb928e2b34baa40

SHA256
ee78d64bb63e03ce71b848cf58a2cbf962bd90f2c9daa637625feb8897ba8648

SHA512
c3340a831ab94b8e82aa84b17cbf2b8c61cb43a0c943c6f0e7781ffb47cd55988c0357d0f54a3547a7d92a711fb407a594eb9a151f466c3bce8dbc794d89bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e781.TMP

Filesize
2KB

MD5
421f216c4b4f47093a1e6df5d32765ab

SHA1
0d1b9f3489cea344a3743a820b6969a699f13e1c

SHA256
19f4fd29001458e9babc4b2ceba3b9d7d11388496f8e4bb4bd45398eb9e6d64a

SHA512
3431758bccf95f27a51a898dd2300ecfa8325920d7c7453a453be5354595f5ec4a87086a22d62357a69dee329bcbd0ae9e6d49c0a1ce0464357738f7d499aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
41d8f0460e50360ce45f5dd02db09ceb

SHA1
e897f43ddcbd1b327a9bed6d77ef27f02b8f05ff

SHA256
02120bcee4ea03afa1b23d5331a5773c3fed91e9ea88dbc82198b4371ad52209

SHA512
0548cdd1b1fb40bcab65195b01f4bac6db2c180a2acc186c36a1f905b2e0a874db6a23997aa3f6c31581f8061726d67eeee23c6d7db4abcc5e3e791a21e87e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d5b8b7ebfccc4643008d856dd4a9d294

SHA1
3e788c9f7443c7538339d94e7b1ead1709917185

SHA256
4530963491cd717d8fe2481d02c090f73855460d0af8e5490ceca321951faf9d

SHA512
a1758fe7d49378063ca3186b3eae57d8f25ac4d4f36b85f5d1764e08b25542ed9dc68c5461294c79da68315705706d4cfafa5f88c25780bbdd65748e592c0032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
768KB

MD5
54d95a5fbd02372b5cedfe86a4a5b99e

SHA1
977ae645f61c8e91970ca9002235c9943796f577

SHA256
a6573c40d8d418324b20bb1c1e3d794994a0dfb0d2d0ab34d518d7637a696716

SHA512
6a231db9b5e40ac83f9aa5cc5c7b61b209493c414f5caaae74739aecd484a4d4f57b9fd99645d26b7547f6eea0f5211354515aeea5cf307b86ede9a6b70581f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\CenteredModuleBackground[1].jpg

Filesize
39KB

MD5
9253716fe883e09e0e25cb03982e5501

SHA1
ac72cd8bbe189ccef10d26d837d54b5ee3a4c53b

SHA256
1ac0aecf629706e0b82427029c9deb0c7c699330e6ee649737b773298ff9d3c5

SHA512
c7ff3e1295e8d0e029f31aaeea35f422915c7751a97b95a5ca1ac5e8cb08eb099d64e56cd7fade9b3b08a94b92ca64979cbb91bf3aa90865b4d586dfc1b74987

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\RE4AeEt[1].png

Filesize
23KB

MD5
447637bff0ae647222c7c372530c8fc1

SHA1
46ee8d47012b0b267ce86e665c4209db6d7240d4

SHA256
d7dfd49ccd8fedf921d1ed3bbc0ee0959374353d87fe4d438553f5fee04069a6

SHA512
cb3b4215c68fdcac7b51bef70d29605a0d5d3dfe0214f35b16d44d8688f987906cdad954239a8a4ad96056654cf32dc255ed047e6e400ef814c7d706d90bf630

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\RE4AzVU[1].png

Filesize
12KB

MD5
8e7999ac4cb49169443b88b0c822470e

SHA1
1b7d4125de2a3d105f83a28d4d0f33a26ad6b7ef

SHA256
698b77c81be1691987876ce8d834cbb9500a718531e5cf6d724d7706fe1ca24c

SHA512
f4b752968d837b0fa8cd8d214602832c333abfb1cea3fdb4145e8f81e94c5abeb8158b3af7d3e0e0afc7685e4661bc08ffd8127c9e232e3d6cb697534457d991

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\RW171ZX[1].jpg

Filesize
128KB

MD5
162add8dc1a3d7cad5a234d3aa997104

SHA1
646fd9c6edc9e5f73090fa4a1831bf796988421d

SHA256
08f2db0a75e211e00a5443b5b7a5deb949a6a1868ce553313d8f594e60778802

SHA512
7e2643b56b8fe715389a334cfec9eb238b48e25f9a4d0307062ab8c990b0aaaa431de3465bfe7b417fd11ac029d3537a0c43716f75740a5d0271807b56c481bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\RWzNAG[1].png

Filesize
34KB

MD5
79d36306f31548141470c8479d4df1bf

SHA1
632c4c8b5d29ba0bd43c536b31e999b3e88a82b1

SHA256
d075c4d965cb13debd571a96cb1bff6b72992f4cb0aea312e7cb24a74fe4b8e2

SHA512
713608194513a60cbb21987e0dec42a8193e5e13f9a8f256d780079c5afcf073b9cdd2ef31878f9f790e04df50fc0bb788715f6ad4d83b0cfbfa63b09f14455a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\TrendingModuleBackground[1].jpg

Filesize
23KB

MD5
9af40429a14ad8cffde48a3e51f97590

SHA1
ae1cbfbe062d6038a48f697f02da7818355255b3

SHA256
14902b86d35f42e5cae708ec4ff487a08910c9cfcd0b4a4839e039773e9d9317

SHA512
3e48735b56935206f17c658f9d45ed32a1928c9203342053dfa4e91c2acdee8e5290e5c75dd7bbfd46f85a3922c6d579501203a7cad53fdf8ec9f768ccd3d228

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\apps.28821.66496411985646769.c617342d-28e4-4aaf-9b96-89dda9e9d20e[1].jpg

Filesize
20KB

MD5
dffdcef26f6d028b16b463567489c22f

SHA1
80cbfc71a24ff583eb2ebbaa60d208916535b5a2

SHA256
f81db3558ec63c7632294294b0be02be984f86aece92a81c9cece94f02c0f10d

SHA512
bb9ba6980078238be36be61153b2036f9b4d5a79d1e51fda230cb7b68aa5e04522e462f06d1f7d418fb712dbe419da79cf18dadaa53e46e76e41011a34736cad

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\apps.40060.65170969132831011.6c6c3131-3fae-40e0-b990-333548e1d2f9[1].jpg

Filesize
14KB

MD5
9340da02a49294f5aaa0f4a8e7991702

SHA1
69b34ac8fb8edcccc6634b64fba4224bb7f1c7ee

SHA256
a5060e5005101aa290e7ec421d5f0015551e4beea64de0993f7fbd0b45ed66cf

SHA512
85a52fe84811394be563f74694ec4a9f3c0eb0148481e239210493644f70be34805b283956ca285634428a760759fee8a1948a99868389c5cff34a3e87d288dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\apps.47090.13688853552204440.93d09086-dc9f-460d-9894-9391f5f31afe[1].jpg

Filesize
19KB

MD5
f68b740499893ba6a17d83b1866fb937

SHA1
266b08d5e0629deb28c44bb89df8983de3f2e1dd

SHA256
6ba0f77d6282add79a893bb0a238d8000732fb1878f72e5e419e323a4209b17b

SHA512
c346c806e297940b74c07fd51fe4149c604e129afedc61185a290725353b808aef5db3c6330be2f3b001795183ccd86c33f235285b3d3e9d9eceadb3a03898d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\FQYWKFG4\apps.47181.14554784103656548.f1f246f3-99c9-4789-bbe8-e2948b2c92c9[1].jpg

Filesize
11KB

MD5
62fe1ab1a14afb7df90958fd9499a92f

SHA1
97cc05ff27782ebb8a4e3d4ae8984791c8a48c24

SHA256
8299931a220be31052e46599bbbcce971279c6639f16ca2208f19e19ffdf308f

SHA512
bca85ef6488fdea5d36182195d906a9c18831d2228ab19740149357658cb73b32a72b0dc99bf8450c4183143ed9e6de79c122526724acc7133b7bf8ef0addcba

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\RE4ArLT[1].png

Filesize
28KB

MD5
9fd10f5cd9305ee4fa39f1d0ebae3502

SHA1
a51980bb1b9ca0b6c27bb239f4871f98dcdf5652

SHA256
e9268cd8fa12fc6486ff8d62de47ac484a0d62420e9be08d2de343d641a9a705

SHA512
433f0e5cf5b76d7437c2b5bf33d56b532480e5b998bff784ffc9f8a5cd5c59fb192452e1f477471bcfc94e56e86c23cf7ec36d6f263909ca8e40d4e23299dc21

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\RW11zGx[1].jpg

Filesize
64KB

MD5
8bf5203fcbfb2c60b986b0928cb0fba9

SHA1
a3a841df54511295a968d0f7dcd307cb3db29eb3

SHA256
7993cb49d064eaee7a420ed48d4aa75ca9e1c593c5dfa5df7b3a6b39dc366385

SHA512
67bb374f7eae49eddf268b28501a521fa98a6847be404ed731a11e49b2b361462adae117bba884cec0456ce52b0615099bd5cbe0990a6a5b729c678c227fdd30

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\RWzD3f[1].png

Filesize
24KB

MD5
99700bcffb90fcc95f7083ea2eb95eae

SHA1
fb85d15de44dd9fb74583dcf5ba68b0e6c6bd2d1

SHA256
e2f6d8a68df49cda67f7ab776bcc02554284682099e5f4f3588ac24c2ab99126

SHA512
682779e5001e1b7462c58e1c0700c471eb6d1a2f130e18869ea814a94689423e37083aa7e685e7939c4197206890bbf0a0d0103dfd44ae6c73b9f57ef1199531

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\RWzI9x[1].png

Filesize
20KB

MD5
70f1af5bf5dee60fba708ed7498b3b1a

SHA1
d7a2e8c2a37ec4c79682243135ccf407cb3c2449

SHA256
3929bcbeb2072dcfa231370fc0bfc3df7b127bffffd44f601ee0313a561657f8

SHA512
44973b43d75af83db093634ce26908d31ff32e6401a91e2ed205f895cb12d727be41f76482f3fef36202aae2c657c0944f601ad72314907d1a5508bbe6d56704

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\RWzI9z[1].png

Filesize
27KB

MD5
08ed26d20d4d99c2436596762728dc8f

SHA1
06fc5fbf57ca21d532401959c2c2957c25fe9bbd

SHA256
988b61549ca30231ab8281dea9c65ff2ea10602a11537490136bdefe993ee27c

SHA512
c0387e66138c7facbe7d863cd7aa3ec94a5dc71b143f6f8efddc663dd5cf4305dbd812a010f3a05b11a9c750ee566a2085e95c71cda7f4ace5523c5d82585b17

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\RWzxWR[1].png

Filesize
15KB

MD5
8cefd6de42cc9942a557e5cce4e931a8

SHA1
c51c222d9051f7431096e2b5544b1143d22c8a12

SHA256
cd0c742e928d3fe82bbca783c0b17941731a643d160052806e5cc3abd76b0b42

SHA512
209aa6a2511de76f7b2a47c797496e50a57f9e86aaf51b4bad105cbd938fab520772c72a4752fab570ba082095a63d9054a4d7ff0c92184e41680f7d2dd726ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\apps.14082.13960116824316263.0d45a6c2-7697-4178-9bb2-fc474428c6bf[1].jpg

Filesize
13KB

MD5
73c58fa84ca96d2465ad464cad02c213

SHA1
0a3ea343ef11fd40115d605fe4359cb5d50b61d5

SHA256
a62166eea2439204476543909fcea288e70c6d12c8bb7cd0942b37cb465d7115

SHA512
93d1a1aa49467f0caa048f73b645a3de0fb9d111526c4102abf81d2e99adfcbf8cdcce2c8282b84d799073b6789ae8157965d3649bb3bea0569be5579a637296

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\apps.18975.13718773309227929.bebdcc0e-1ed5-4778-8732-f4ef65a2f445[1].jpg

Filesize
17KB

MD5
a36e1e2cf2a6e204f117010aac07603b

SHA1
adba3fe180ecdbbb905e0236119c51e365fc9b6d

SHA256
439471771e0a620ea71b142e21b65fca7c978e08f0f28938abe5fb7b9540f84f

SHA512
9da210f711f167435bf0dbf8fd0a33729b3f9dfaedc05afcffab86f414c25463db396835f6d2dc1172efa092341ebed5f827ea54aaf2b65a493c5bf5eff3a231

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\apps.48809.14059977417461965.6815699c-e5eb-4b2c-a91f-6dee7e3448f7[1].jpg

Filesize
18KB

MD5
57824ea5408fd34ef52382acb95b8d0c

SHA1
f727d6d9b72f5752483319dee3efe7fa7ea6ae23

SHA256
1eee9ded864c96222a10d663f37779fa71b09f9a494478d43f3054f0f2a811ec

SHA512
c6f7ee16a1d801150d186e13aed6d13ba9ee84ebd9b19dcd9b8f488bc5b8a9836ec83715aac196f659cc5ebb7ae7fa13bacf30bdc4a48654daefd664b4bbc280

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\apps.7437.14492077886571533.28b7d282-6a14-44b0-bed0-cecfc2543cea[1].jpg

Filesize
18KB

MD5
e65713cdcf9684bfe9cd80ad19f4563f

SHA1
5fa7c49c9513cb66d30d32a3b67f924dcfa9be40

SHA256
569e348f4185105b700dd4b1b44b32902c5868077d40983b18246ffc7da96860

SHA512
0e10b793d188aec469e342245d356788159716f7f81be182b624ddd36449c7669e55412635ac95027a73848f021ca16167f88dd3d541965e8237cf0e3a0b6551

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\GL364YOP\c679ce21-8a0e-4049-8e00-ca67dd790ed0[1].jpg

Filesize
973KB

MD5
5b652caf841673eea91ecf1448ee992e

SHA1
7579fdb83eefe64262ff683a76f515169333739e

SHA256
e75aad92eade778074e015e9fbdb30ca02654add020c6e086e59dbaca106e1b0

SHA512
fb386d1d8d4b58e1362ed44876e1b6ca7642d1ddb815b46d0535bc18eda43edec4aa7b4916504aa14b229a8ab9ca43b95f0706c5f90bfc7b05ff69ab23ec5063

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\RE4Akg6[1].png

Filesize
34KB

MD5
a7e05de7f0bf65690c75b93459598a3d

SHA1
c02472d44d11a1f781ef91df38da0ada8368cafc

SHA256
12fc4e7ba6aa88553011736c742c7326c9bf46079e33418a839f14fede662483

SHA512
75f48120224c510040ce2f27010c1c02437f4a59bc3fb0dd891fb02cb943aa62be869d2a5e14faf3a58488ce27809f844d5d09492e0ba0cc7c235cee635a7b20

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\RE4Ami7[1].png

Filesize
32KB

MD5
c5d95e17aa36665b9605f47ca2b90d1f

SHA1
6199f5adfba0c8e931cc685753e7e713a7852624

SHA256
a8340be99072d55aad6a821d5026c3c84acfe4969e0b172cdf1b459de4561263

SHA512
55be7a2bb912d586fe416b3dcf41c83266990142b4f6a0e1ee4f0b3ef1fdc72c39efd25b18913a923011aefeb2fb70d411e38adb861acbaa3c14123d1bb54b18

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\RWzL70[1].png

Filesize
30KB

MD5
67145f34d0d913f3ef7314b06b53eabd

SHA1
88809baec3bac24e637504c44d021ca179c9d112

SHA256
f9d3e1a2c6143c5ae9266f4d819cc5901a18ec9d4b44dae7fba3d8465e403b0b

SHA512
b3aeeef6f298a1fdd756fca07d97c4f366e7f1b8b19c84219aa532591e161eff88760de8b68d4b6ace2c90afb6505d86f007314990d11018cbfffae8dc1a13ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\apps.15024.14156112272410024.c97aaa08-b76a-4d2c-a86c-f8b3cca433b4[1].jpg

Filesize
18KB

MD5
9eda57cf98d7bb66236ec29c76af6eae

SHA1
10b46ffa604852a4812b65cc621d4db1fc1487b8

SHA256
d037b8b820b3d248d80183c3d6ffa80ca99bf87016bac5af3156d9d90169b18b

SHA512
baf8792a527cc24f9383fe406a555825dc27648e6c602752943d2a1634126d5e746ba983972df542cd1281be4f8317319719cc430f498ccf9dc1259cde0b3604

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\apps.15983.13704965593711325.c8ed22ec-c56d-4ecd-bbbf-e9f6934161c4[1].jpg

Filesize
17KB

MD5
677a261a2919a24b055230abaf690126

SHA1
d8b73215bc3ed93fc20407d63e4e98e1e02278f1

SHA256
1c8a27b72a873e9834f0fd431b7696cbf9ecee3ad6b929547191a9deffd0f697

SHA512
9bd7ce052bca5e739166847ef5fbe9a7726ed43cfee826262e45a953293c3f3d50c2b996102de1a3676e593245b93e9c634590d07e94743bda3ea4260f53fdce

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\apps.33035.14087177463540042.91ee059e-32a1-44e1-9f93-a84110ed392c[1].jpg

Filesize
18KB

MD5
fdae9212cb76cbcb899aafa7ad8d0168

SHA1
6311ab274f7ff120d3b2b03924378a117994ef6c

SHA256
d44db13ef87205ac1ed720bd116cbbe8e2331b98d7e1525501e7bdd4ebd16290

SHA512
322c49443aca8c0063d55c93f8d0cb5b4cf35eb294102988898e2c11a582d0007cee84c84765fcb1ced316070f4eae0703a85cfbcd2cad776a72d4f0bd004b5d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\apps.39109.14336879122555401.4c30f6b3-d0ef-4997-95dd-4b1a894b1874[1].jpg

Filesize
22KB

MD5
87ba6436786e1798f1df329fab74c871

SHA1
5d9a1e148f20b3118a26bb630903aaab2e7eac27

SHA256
77dc201fd17889594593bf756e5373066cbea45ce1d998db7135658cc1d0d88b

SHA512
b6fc3bf014badcd9d3f7806e2d8e51417a4ae756cba26fe3ec6c7d77e85c497594aa53b8c089d104e7aef3bdba545002104c2e80d0368cdbe6bbfc5a2bd30741

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\apps.52474.13933572731724600.75169247-997e-48c1-b1ea-e2985f289c68[1].jpg

Filesize
15KB

MD5
5f02e4d1943cfa60abedfe261c7ab75e

SHA1
8d2671008b2e0dd50704a2db5e34c8126e54e135

SHA256
6e1704fd6307574e28d1a78a300362f5f6f9563369b370f15a85920554d8befc

SHA512
01ba1648b70ff9badd88205413f00f15b9d95f2d63cac8edb5ba0b4f5964f2ec60ddcb058d13516643f8c1248007c5f63a40e84446d05fedbb99f64d2ca2a6a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\apps.53961.14127010465288187.f9de4a96-0ee4-4da3-bf66-d4132b38c599[1].jpg

Filesize
18KB

MD5
cc468bd6de22b8d454d4ec344da406c9

SHA1
fe9564f493cd36ee5dd74677d66a8cd287f8bcf9

SHA256
8b6c0343a17bc999b10ef37833f8ee440fda15d8a31d3962c5bb14284ed0b8d9

SHA512
5a57e8fceb28eee0f2849ae3fb638a118a8d4e1ac09a91928a80f07d7fe555288bb242c7faad197016cf40f3003130cba7ab7ca05b75d9270ab483983d90012e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\apps.8266.14337700501983954.bd1bedb1-636e-4cb5-9fb9-6bda5bd998e8[1].jpg

Filesize
15KB

MD5
7bef2387d359d55532962182121f65a3

SHA1
65763deaff2dd2e9f5314a1d395a113e309950a2

SHA256
a5ac4bb568c3a8f921ad588d2d89b7abffc033b2b782b648f7fa5f50a7c1a511

SHA512
411778822c2d3c12a3fc0dd810464378f331a310734ea3698a043ff3e4701d0066f76a6be04fb3b0553e99cc6fc11f31a80db673004d21e3af7f553e35d11dc5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\I2VEXGBN\v2[1].json

Filesize
9KB

MD5
20743fbd31e10ac974f21257e284309c

SHA1
4971063fde1787d471688e2070e22ae8dcb73705

SHA256
f81e34c480f11387fcc1e3aca575c0e92831a57fee83b023560d79a9443dd29b

SHA512
57ac63a7695de2d724012c62d46ba9b806f58020bed82311788ecc302c82ce6b37c935b073510765dbe0be08f05d366e5434f811a0ea35538818da262374294e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\RE4Amia[1].png

Filesize
28KB

MD5
7361e82644bdaaa11a9ff7920488044d

SHA1
50d44303858789f50d22498ff134d49226af65db

SHA256
54aec9e5468e76d8d9b74e0d4e09711507d1b09d432b11aa547d63efe8624006

SHA512
a070fa960aafc9fc1fee4f7fdba227ab4a5f45d6eb2bd8f85bd50a7f4d8bc6f4e032a18ac29fe2ae1e978d88e6dd7a3280bb5a49f35ca02335d593135df14592

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\RW171ZX[1].jpg

Filesize
256KB

MD5
f1307bb4c87fc6b22c3e70584b7f8407

SHA1
032d047e25c1cb3ef5a030923bea5d9a734a4d24

SHA256
c79c36097d1b5f8b78f6aa5c0ba25c00468a3ffbf3ba3e09d645c37768c6ee0d

SHA512
0be4a3537fac1983af0331a7fe7780dcd0f7286b54f0703f36a809a18c6b9c21eb8709acf7de29ea1199658cf5397207e543ad9ded74626a464acab66bf47ef7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\RWzI9A[1].png

Filesize
37KB

MD5
16f4eb91d22d234190cc6f69b0193ba7

SHA1
51818a6d77cab0adddd5cda7b546a051e594c25b

SHA256
6f92b890d75c84476115638cd0884eedad22004f34f5fb4e4d64550240be53fa

SHA512
b2228d41b887ea6aeb276e6b25a1e60cbb07d8d717b182b85ff0160dfe9a29e8402a5912ffe805a35452d9e888273ae27050bf79c0b9dddf4565f739e3055eff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\RWzNAD[1].png

Filesize
28KB

MD5
5a2ee19a378f000ed82714dbb5b97256

SHA1
edcfc341e6b09458a2d32f1607421c50421e5029

SHA256
77ab4d9adeb2f6c5939260a28cd9fc920b5ba9f8389ef717ad3831896c415b70

SHA512
e3f3ed919359e45989c84a128631e05ed6fa16795a77e950856da61ebbc3d075d1c33cb3dcd69b83b94af38e854fdbcdb57a8ec00f25749df9a5178ee37d2530

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\apps.15509.9007199266246761.ca6040cb-54be-4f0a-bc9e-c59364f681cb[1].jpg

Filesize
12KB

MD5
7ca1b8ac855f03d6ce6bc083e910aa95

SHA1
4d0961e7607f2fc11bdf800f2956565320eee391

SHA256
b422ff53461589499c2a235692094bdb6b7d0bcd3d4e67a94c26f8fffe6ffcd1

SHA512
4670b8aa3ed8c629e73bec8b87a62d63b0b4c4f538d96d3f612bb2a6d0ae99af5b195042d7576e7930c4cd8c9e2f8596a10830d7e40acf7b69f1188f09b1da96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\apps.1647.14419706211314168.b0f9d237-3727-4f27-a56e-60574c628757[1].jpg

Filesize
11KB

MD5
dc72d862487fea540024a4728e13ac1c

SHA1
0aacb52b1f49ccd4d2e725a94dd32e260e06c6e7

SHA256
c97d88735770e98e9c67bc5086fb8fa0c276c7834da610fa4a6372b31d770e01

SHA512
3fc754d79a438ef5889dcdb704c327cbe557a9e3c03f3c8a7780fe763b12142803a1a1e30e2293705396d6046db9b8455f125724e21267fb78c224b9e2c0324f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\apps.28511.13663857844271189.404e9066-b027-4438-ac33-00126d0fe125[1].jpg

Filesize
14KB

MD5
53dc50904b1d2a5bb7c7d98c5c71a3e9

SHA1
74e1090cfd2766724711a6364398fff319097183

SHA256
fa15877657dbb5f1ee3caed4d36a325c793f574c583055d7f6b30104700bb7e2

SHA512
80a9406122d03e9e05369607bd63d844663577d8b7b1b5a6b405888108adb3b988fdaeb5f08d1492159795aaf3b0a5274e0b21b9de80c43db61f2a60198f3e52

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\apps.60360.13631853399995812.7c8d5b79-31b8-46af-9143-329dfb697258[1].jpg

Filesize
18KB

MD5
5ffdd249856c0325cab8ae70b6751969

SHA1
2d90520f36c4a8fb6076d9c0678bd81eed99070a

SHA256
d1d93387b7b7efe8c69b2557a3b336a5a11a64a878a15be09d0c3c67c4a0732d

SHA512
8bd6d3fcfb53bcb2f97b627aa081123899d0504c7f0120869daa0807fcad24902de9376906f7d10aed6937c9ec830fc75c1c3aec2a3a249f5a39f38e6a30491d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\AC\INetCache\YS6W871C\apps.9206.14162616918399619.3bd2ca47-45c2-4302-b9de-350727313275[1].jpg

Filesize
21KB

MD5
19c8441d726b8ca5f4ddee917311a9da

SHA1
3e2fa6b65bfa6953f87b8166eab4408b74c122f0

SHA256
da50fc6dac1cdbae97000ca342126f28e4710a017cd47f8a7eb7c6874cf00140

SHA512
df1ce462a12b0cf1e36024a8d16c0795652e0b91cbe0053983adaae713e4fb8e3487119189a73cbe35921e761b5ca7f584bcd5896ddf361c02d89e4584023fec

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
621B

MD5
3268d81b21d0fbad079526302be64a2e

SHA1
6020904917dd69f60b48a6e9749c85fee8ef7153

SHA256
7d2fb89eaa9ff73b1b9e94e5612618ef0d09023ccf9930a5791291194dc15b68

SHA512
014efef0b8f6a1df4082199ee4faffc8e8a7d9cbbbd671a16212a67dfe1dcbbf55876c3461725362befd37efffa995eba0ebad8a3e78c69da6eeaa345777c33e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
882B

MD5
0fa7902ba5ad0c2ded9ab3e70553069c

SHA1
620ccb69efc7b440648023bf27b8158059ce8cc8

SHA256
2ef44b27f7410ad8c0468fd201ed0fe19e07a0289d221f95803cffca5ca667ca

SHA512
2c256acaa87b8f4efbb4f80d942ff48e385a4539ca320c0e29b0d4dc128e21bc23962c4bcc94008ab76606b8886901bb56ead456388d43f6ea1bb5b8850f1841

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
2KB

MD5
82b2fb958ee615aa4d3415d451f5a29b

SHA1
1ded0625b673f0ad4b31b8df656f9bd2f47cdb05

SHA256
d19dc23ede272cd48b66d08affd68ba88ffdda4ddc4206e24f91b6b163d79136

SHA512
c1c465929209d63d5cd2e086cffa562f8927f190e5c8c05b51a0f166470fc8250ab476079ee9fdb5d19c76458f2a39d89ea705febb984e0541fc3f00419e18f4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
674B

MD5
d7a5adb5c501f1b1ce9b7878b1e214a7

SHA1
39d7c1d7aa209907765fae9bbfc3090bfee86d2f

SHA256
3a5ccfaa4fc57fb21cc9e8887ad003f8a88776fa83f6be53cf722ed5e73d1521

SHA512
262aa65154d63f4df5e5622eab40d73868658f4fd5b51e24e3b7294b52e185e151a04f51d9e1ddd709f3ecdc2893bd2c53f5dbd4331d6a22d3b68e64753efbd6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
726B

MD5
4735a04ca4d27813e5680b26f04d5c34

SHA1
91688d7b337bc092856d7006bd40ca88dc42ed95

SHA256
88c5cdcdc03f73b393e1b452ffb9d264c5203ada2614e3c613f600a169330409

SHA512
ab2cd824a0ba97747d979678d61f02bf2c12cf0b583fd54ebe6ccd828c681e167f3a98022b0bec558888f454aec169e2ac38b8ffa7f648c9bf5da774abca28b7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
2KB

MD5
8a38cc892878611d97076e87d2d83dee

SHA1
1c88a50b5fbbfd216676d4ae3a313eb9e6210b45

SHA256
4b3ffc61acb9d5393ebee5bb957c0708e433654a164a6e2ad36f2188cd273871

SHA512
51878baad81cb161ae663b5c91941c61bbe3ead3c07611ecce81bd152a2f22613d7c03d1f8a0a24940aa3b56340dd4a4367c1938702ec0016440ef286443aa63

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
2KB

MD5
44b710388f339dd9bf64f75e87fc5567

SHA1
503cad109a344319b86326180d53831b884a82a4

SHA256
80ccc020e53096f298d8f8de73d762ff41eb14d37993037cae5b34db86f0f436

SHA512
ed6d894ff98a6fb669facaaa9c7a175e277199dfa64bfa13419c606c5239f43c0eed787e82dc6b562871a76e29d63b914c8573925675e890db0f33f98abd5321

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
3KB

MD5
a9fb5f448fa88cbf0da102e20f7f85c6

SHA1
f13cb06389e3fa1ba9c357f69e9a6766f5f10afc

SHA256
c8411e2fa1da21ef79cf2fd03924112879aeaaaa4516fec5be8a515f9fcf6eae

SHA512
0fd06d6f5b461290194c8f8c20306a687cebdc29e433bb60187d1f4bd4c7be417c61b72ff4cddeea21e4e9772293bfbbe4842ec7406649b3569c6ee1f6286a5a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
4KB

MD5
c44284c3a16ccdb73f56ed22416252c1

SHA1
d7bced13b60270efab72a160224047155c6fa13b

SHA256
b46c069045e94b8c2a92307e2aa2cd8d08261d79b30f9c0e5906caae55399dc3

SHA512
c179dc796c8ee6a136f9b75e14649c2a944c2ec4d3ce04648686d688d1631f917a6986b41cab70de81eba1e3ee10d9fc3aa3587fcb76cf01db36beca42f0b845

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
2KB

MD5
1c487caa201ff30120b008c2a779d18c

SHA1
c623f6d7b524dc065de4f95328f9a94a4864614d

SHA256
a2a5eeef116b6a3f01b0daea08cbfce38cb1750a9970748acff2197a9c801e06

SHA512
2087c7953b0ad5b667a3cc16cf26cf75dbf0eefbbdcda84b216e04bc70b8bdc3d5ae51ec40fb77d7593f354047878752d58abf6a2e43b64e3e6b866b62994868

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
780B

MD5
68b7025feefd3ca7727836aae9c34e72

SHA1
b187f5f00d8280e52e76539d6a45a32d12d8df8d

SHA256
fcbae4a67ad0e5c9a350b9de92daf00577c8d68d1e62dd508802c7b36fd3b0d9

SHA512
62be080ef7cfd2c2e814b11367b6b28e0cadb1e62858096d8e8f2f2c9020aa5307504a615a8282e5a4a69acf4317fdde0d6891466630d46324dc291f07c203f7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
832B

MD5
277367cb6aef21faf3f962be0b78c9bc

SHA1
29f8b07be22613ff0aa590632c1f41b1949340eb

SHA256
df5bf3c5b0cf5b2e695478e8905051bc2219f73e7a1d2477c99eb019b0940d9a

SHA512
d92a5e69e94c80f15c9457d48cd061e18ffc911f2e7f839a3dd65a33e0af32ef6cac1e37f072604d104a0a1eb848c2f39d12a41f9362bd42432deb53f76e2956

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
3KB

MD5
307764286957a65f24d2b160559700fc

SHA1
d11e1d10b7750cbdc427ccc79f3347b63f0ff4cb

SHA256
120b5feae091f973b96d6001bd18818ecaaf1fd67807fb75655514e9822a89a8

SHA512
3c7ee320527d9cd29064eca6e4dd922988feb65ae93cfca606a3127ce4faae52ecb25abc4042299f89c3503210434f444a245b23bf141fd2b7e36671ddbc6fd1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
2KB

MD5
31255e953c52f69a7baa2e6272e5026e

SHA1
09a4bd9fa53642ce3c877a99e52ed1cbaf28a6ce

SHA256
6bfcb5b2247c2ecba10991a7f5e53ca12b011ec09a7ea27a96ec263e6291c12e

SHA512
9f40ac45f9bca0bf8697e29d1009ca442a38fb590a072ab9034aeb95cb0e9bbf77ab8564ad4fdef205b8fa9353add3d90b5bda649a8fbfaa51aed6705ac0774f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
2KB

MD5
4049bd9dcdbede1e4d3e7746b77ed09d

SHA1
c8731496643323122c528890cacf125a527964b1

SHA256
1a861207cfea5326ec051ecc1965ea0f1b2d2d493c3499a95d31d084be010552

SHA512
ced7231f55f8c88648df56dd967efd4e69e761a6364c9ef156ae7ef2f6e082f2437353b1ef50236d5d15d502a18f8dbe77b8afb53012460fa69bcd8e66fdf2cc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
3KB

MD5
3c994eba1ddeca929b139abcfdf33859

SHA1
c9b5008e1bc6dde46784309023c8787e01ea0ed2

SHA256
1aa7635491c755dc28cf3989b7b402efc9a4362213452fb8656353267cbec3c8

SHA512
d7cbf0e98d695e937bf55d48cb3a7df336e64aa2bb7ff4bde110d1fedba34437d34da40fbc5dda5802a89a320bce55582b26d8513eef031fc33656748f9fd69c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxAppServices\ftc_log.txt

Filesize
2KB

MD5
eb8b9dd5e9b049675e3d4f57b139b799

SHA1
ed66203fcac37e897feefd3902883fb75c6edbf5

SHA256
fba5fbed648db2db15803e4073ff7a5d5d058cde7187201cf06316402df7160e

SHA512
ca29042a3175a477535664279b42cc768a9277b0f7f9466f9534d1ce99debf27e261c6db98d5773779b6a1a6958a11ad59b1e4778250171eec492096dac8e0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsu462.tmp

Filesize
617B

MD5
eb18807311feb29b7af17b05502b55b5

SHA1
af8c56b6b2dc4e2ee31af32e3c070799e3af2a68

SHA256
f78f25680177b95ffd485846f306bf307a9b924fb66348e8c8880085254f44e8

SHA512
0601974619387100106391664ce8085bec6a94086b1991131739b2405c93932ba9c7fea57ab27c365a28430c0d1c93aa9c4b4862ce23f4250261959d9dcf0f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsu4A1.tmp

Filesize
369B

MD5
8384c87863e3fd91d35728fe62ef67f5

SHA1
588afa62ed8b7193dd7be34057047caab4543d91

SHA256
ed0aa992519fbeab0e6f6a2ade2c190b9554937f1aa402136ba8b9b6d6ca3c87

SHA512
78b9a6cfac675ea823655326c53e531e674f108d69cc100a921462938b235134530623c2b5e637eb0bf0b406482d04fd0ecbd9b7f162a0acc679d1ecc6569d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuBE2.tmp

Filesize
1KB

MD5
6e68b4e1c85464f399982e6fd0429f87

SHA1
98e71ef63b71167adf9b2d339bd4365998cde88f

SHA256
656e4ac8ff87041935c871cdc58fad7abc648d6437013de19911e17c80ae5569

SHA512
53187e9644514ecaa05d0db7a84e3eeca71257f5dee17a2d054855e0f3bf5c51c67b59d85493d9492abb026c913f303d12cb6deb63ae3c59351a5c2c2d539d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuC892.tmp

Filesize
555B

MD5
1a2900ac67df43d223038a9d777a9a06

SHA1
a497124aba488340795318f90d498c83b2bc921e

SHA256
bb5ed7d55cd3ca53698e82d8f01033750e8fdf18a38348c5ead238167d0e01f7

SHA512
6343c1a29c48c2fed30a16db527fc5f5e822c20ab02ee22d466a8c0d4f36b384ef91412daeefd673444006dd6850e853d285516ba4cafdeefd76ee59f51a13df

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuC8F1.tmp

Filesize
1KB

MD5
09c77043b9bbba0ff9259f0ae0a033bf

SHA1
2e868efc654a0d7be1d9fbdf5e635ad88c8b1163

SHA256
d18cab185232b0e56b561c356b7f2e030043e31c4e3ecd1452bc01d67c5e4c7a

SHA512
090ab71e5c6857a8fc05f8b7b26d4f0281176158c21bd734e527d30c8c25f014781df75a6a46c4c1cc99768ee13ff809f83d48fec026b0aaae80c22245767024

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuC940.tmp

Filesize
291B

MD5
54d057449bf4c7f5a79a710c15bbb045

SHA1
84d95fa383a35757e1dd62df8c951dfdc6ab03dd

SHA256
3d061ded89ee954c07889725fac8c9416c92b1be6e330a2cbc8a17eb608d1d5a

SHA512
71cca88776a8be338a8946fe7b1f4d28682e5dde0420159a061f1ed2abd3db226045d72ee1e3bb413c362cb44f56cc0696ed5eba21a29fa9814028b58b1f784b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuC970.tmp

Filesize
358B

MD5
7e8fa5e5144027cc1d03241d6f3f6502

SHA1
1f4eeacbd38e4a5af68362cd223b10c9bcc72283

SHA256
c277eb4479795bd8ddff2df2ae82b1dd95bd60002ea3f7e5bb80abec329febd5

SHA512
2a22a98ab2c4988925108271840a9e94752405a355e457f042d353eef2e528fc0f41fa6e52f7bb66b95b2285053f28d4e91df22eb1f4a0c1b4b812a8c6ffddb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuC9AF.tmp

Filesize
636B

MD5
ed633c66bcfbad08c1a87002ee9abb71

SHA1
e197bfa0d3b0bf724cfba9583841b998bd634b2f

SHA256
c4998276b4c9cf609e4df98d54e36084e1a1b5c7f733d07ff68b5c898416b00e

SHA512
b07a584fb6be2e897b85f203ea1597fab033283f7d86a98b47671699022497b509e0b4468c3bd5789c452fdec3e2daaed62f2f8f2b16bf2bab851a4e43c2b2ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuD4DB.tmp

Filesize
1KB

MD5
2021d38a1b2c72a06bde60ee18daf32e

SHA1
c96cd0e2c91d0973e185151dbb18e0c12de3894b

SHA256
0afad0f3128453007cedcacfeb718a4cee45712b6e018cbac8d37f5bf74ec72d

SHA512
3c3604ec2a5afb1a6992333fde8ab4c50ef73b5c7a6adcab1c5830af2c80b0c51340f1961326a174f68ff2ca8820e6edb97e67c8ec90da2ec2c07589ce38bbf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuD52A.tmp

Filesize
380B

MD5
79e679a2412916ca3ec3e4748af3485a

SHA1
a9ea2647959c54c7b7bf96cf2e24147f5d803e51

SHA256
6f7a78f06be45c4858d3fc7885185354b6dab9275df1955800d550ea091872e5

SHA512
d5d512555ccb131ad3721692e12d2212ce0a0d8adc3db9c41a72cf924ad6d72add2d517e1b49705c5c4515eb624a85060730f9bb839734aabc7f8cbc52e76022

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuE3A8.tmp

Filesize
2KB

MD5
fa919706b6ffbbd644142ccb89292234

SHA1
d7527ba70914903dc31f6a83c2e231abb1d1c0cf

SHA256
47d03f97dea042d61169c541d7302747d1c30d7a6792a84a84518bfcf7c67e0c

SHA512
29378885929025c82bd41edf8d65671cd34297d100c6992eba19c6eb38cbf935590a0b8b891ecf8df0e4bdddbcb0a361c4bdad6280b82c3d24524d18a0362b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuE3E8.tmp

Filesize
5KB

MD5
3ed38c0014affe2ac3170abfe380a88d

SHA1
522456d0280bf8f5b5048378010af575bb53add6

SHA256
043ae5e8549b59b52b948328ff87b5a122626004c4272a11112ff7a21f160060

SHA512
bc2708064c91dd53ee0f7d6e79de13e33a309f5736513e87670ce4646468ddfd0bafde1ee91d105546f91e4c0aa59d6e3176d4907806374956c80523dde0dda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuE418.tmp

Filesize
633B

MD5
5221cbf2a0956d5ae89c689b6ea2eac6

SHA1
42825b6b3eb87d4c3727b7d50c9031e474e61abd

SHA256
bf228ba852b802d01f199c459cde4523714f36249e46163e08be8ba3b71c2998

SHA512
93d60bc1de398329e597067a8b7f2eacd7112d598938d14fab22c73889a2f5f1ddb7a784309840b013d19f0e0032968286f3589218eda479935024814611bb8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuE457.tmp

Filesize
1KB

MD5
34a991eae2b38ba61e7fab97211029a7

SHA1
07ef148300b89d990f3b5647d99ebb9b0b405a6e

SHA256
f0810c6fa3f8a66249abb5ad693a9d3af58e3dcbdd78b72f85f1bd807a6a6eef

SHA512
abb1a4292e4f44144b495fbb45d945174cea4a37b4011a6cca67623a91b1ae245b93210b30d56e60d5f0cd765fdcb5cea9ef1cfaa4b826e59382bb16c2b7fcf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuE4B6.tmp

Filesize
2KB

MD5
70d11d5c00770cc2452d0711a77a9b67

SHA1
f10fd9a072d7bfc1e558107427bff5b35767668f

SHA256
930e892c80d863321e8e364c2eba4964e9cf32237c7a747566ea71349afb1f67

SHA512
037cdfdae173973b3cde25bbcbaa57bf624751145ae1b222fc75d35503b4fc54d0ff2029f6e83659dfa4877f9bd5a8a85b121242323451740aba412fb429be7d

Download Submit
C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe

Filesize
14.5MB

MD5
8abcf2232e11f034bfc39e95c206602f

SHA1
8fa01e35a8e4b2ecf9534752c1d53c6ab96c5ae8

SHA256
c2db543ab00d2260889a71dbcaa6f115238f36f64364f5c936500b0da0a2f52b

SHA512
9c7e75eb4842ccdbbe1f907d956e721560dd729979b0efb409c30bc848a33d3ad200ed7738eaa12d72ed1cc6795c2d1ef0fab619e593237a4df1863b7808047a

Download Submit
C:\Users\Admin\Downloads\Forza-Horizon-5-Windows-3-563-816-0-en.exe

Filesize
14.5MB

MD5
8abcf2232e11f034bfc39e95c206602f

SHA1
8fa01e35a8e4b2ecf9534752c1d53c6ab96c5ae8

SHA256
c2db543ab00d2260889a71dbcaa6f115238f36f64364f5c936500b0da0a2f52b

SHA512
9c7e75eb4842ccdbbe1f907d956e721560dd729979b0efb409c30bc848a33d3ad200ed7738eaa12d72ed1cc6795c2d1ef0fab619e593237a4df1863b7808047a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 506638.crdownload

Filesize
14.5MB

MD5
8abcf2232e11f034bfc39e95c206602f

SHA1
8fa01e35a8e4b2ecf9534752c1d53c6ab96c5ae8

SHA256
c2db543ab00d2260889a71dbcaa6f115238f36f64364f5c936500b0da0a2f52b

SHA512
9c7e75eb4842ccdbbe1f907d956e721560dd729979b0efb409c30bc848a33d3ad200ed7738eaa12d72ed1cc6795c2d1ef0fab619e593237a4df1863b7808047a

Download Submit
C:\Windows\Installer\e5a9145.msi

Filesize
828KB

MD5
29b6790dfdba0a2513c331363ba8289f

SHA1
150c5fdadc4d8c02989e20f627c90628cbdbf23c

SHA256
7a8270f0cd3e03a7ee2fe37b26b769cbdf3c66e2e923e9dfb8715b817629744d

SHA512
54ae7bcd53f9fdcb34ceee99245540b459f215b303f53ad7356d4f91de601634eb1d7f23a928c414f10227cbb66e1dd4f42e35333e85e23ce267452030eab8d4

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
146KB

MD5
8441b317190028fb71e86bf58b59188e

SHA1
024e401f516e65b6f9c5c129b3bf0ed360147d43

SHA256
9e0e71f705aff48c8acbb9f47e75c5c0d947e33774f031415a9f47d634f21601

SHA512
28abca4952e40963d2e1e15292601da647a3d589dce3473482ba9ddb3d43c498e45b233911d5898d7ffc3f3e527c7c310a483c69e0940df659c9742ebed3f2d9

Download Submit
C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_7d40425feb31ec57\gameflt.inf

Filesize
2KB

MD5
887f0d14c8a2b33281ec31033ac35a0e

SHA1
26dcf1ea5e9cd19cbdbfffe49ff935c21159f94e

SHA256
7800b0f48e0fd1b17642307af27c89d1cbaeb199203455ee48b0ce178f090d6c

SHA512
3ed0046d46482d47f580c0265bd12c8421894c67a3c80e0db39c2452578654785e51d1315ecd98b2a1b83f387e9fd7ce51b626ab8c2ae04b68d637ffad161407

Download Submit
C:\Windows\System32\DriverStore\FileRepository\xvdd.inf_amd64_45f35b192221e9ae\xvdd.inf

Filesize
1KB

MD5
a91b525f9686fe6c3bb30ac95c1928e1

SHA1
dcda9b4ebf7a2c024518292a44a07639179dc220

SHA256
bd5c2632d4d29645debdbc51238bd5de6b4fba5d30fb2a346ede60713ec6f01b

SHA512
ed933cc1db3c29dbb57de8ca44ae162f012d4820cf5e836a588fd9dc8dc959c03b1ac0fe9569a89ab16ef5af30862882aa2504d1f7838ea16c3a7c37c4098628

Download Submit
C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\SET9F00.tmp

Filesize
11KB

MD5
af3c920c92f0688febb19b4805200d4f

SHA1
c35515e4798f560e217ed9208881156b4606b4fd

SHA256
a7d560904523a020f5c2ab82632b3a91692a2bbfb7ce06bd9bbc0cb9fb1949dc

SHA512
a51aaa6d260cb54cd30f7a80d95a1f0d3919f203627d8eaeec6422c70520adee6455f6c0cc2dac468a3e389846b6337673dad937eacb4ab8f73fda4ffbd245b8

Download Submit
C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\SET9F21.tmp

Filesize
1KB

MD5
a91b525f9686fe6c3bb30ac95c1928e1

SHA1
dcda9b4ebf7a2c024518292a44a07639179dc220

SHA256
bd5c2632d4d29645debdbc51238bd5de6b4fba5d30fb2a346ede60713ec6f01b

SHA512
ed933cc1db3c29dbb57de8ca44ae162f012d4820cf5e836a588fd9dc8dc959c03b1ac0fe9569a89ab16ef5af30862882aa2504d1f7838ea16c3a7c37c4098628

Download Submit
C:\Windows\System32\DriverStore\Temp\{2e330ea5-a555-d94e-a9c5-4a4e9f59c389}\SET9F22.tmp

Filesize
651KB

MD5
da35554449881ab09f3692b4f920bc84

SHA1
97ca96471c153404a303835b931e8f9fdeaacbdd

SHA256
a7f1fceb672356038d63f1658ed7ab700b300ef2c389fe1e96cd169a0a448c53

SHA512
91e4c7aab14327f7581c5f1c238a8533ff366897c80437d94265b8ae6b400e311c30da5997e471d75dce0a7c578d740072da2582b416147535859b3d512607e6

Download Submit
C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}\SETA4FC.tmp

Filesize
11KB

MD5
2b0aef3f4efd549637bfe7091c813ddc

SHA1
65b8d07bded90a4f9bdde04981cd5f86e741421e

SHA256
8d75f1481d117755f9d7fd44ce14a1f5dfae46a1c1cde7162a93eb4ad21443f2

SHA512
c6be56cdf131496e819798fa0fc21bb04e2224c6c84809ae0f9a0197b104b99e7729eaa486eed1d67044743798c2991182efd68d27366a18121f97adaa8c3c5c

Download Submit
C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}\SETA4FD.tmp

Filesize
2KB

MD5
887f0d14c8a2b33281ec31033ac35a0e

SHA1
26dcf1ea5e9cd19cbdbfffe49ff935c21159f94e

SHA256
7800b0f48e0fd1b17642307af27c89d1cbaeb199203455ee48b0ce178f090d6c

SHA512
3ed0046d46482d47f580c0265bd12c8421894c67a3c80e0db39c2452578654785e51d1315ecd98b2a1b83f387e9fd7ce51b626ab8c2ae04b68d637ffad161407

Download Submit
C:\Windows\System32\DriverStore\Temp\{440c0942-76fc-f443-938d-82d2847421d9}\SETA50D.tmp

Filesize
139KB

MD5
5b7b08550e6301040c9f44944ba40e52

SHA1
0630f4a65932232bf63d9261b1013f355bc78d8e

SHA256
b138b2b591cf030604976d33c010ff2d5b845b265c6c8c0507b7beb0b49e6c59

SHA512
9f8bad98a9e6cf46ea977638a3e2827c4d14b263f4dadd6f3d91303d618b80429fd67ef00388b2c324ad334e7fb4d73527e27a5fb28317b5971098449ab8f02e

Download Submit
C:\Windows\System32\GameInputRedist.dll

Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
C:\Windows\System32\GameInputRedist.dll

Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
C:\Windows\TEMP\gameinputredist.log

Filesize
1KB

MD5
75fada219fce4598cacdd3e9281ecbe8

SHA1
e22fa0de4ef38c532551c4d1267e806bd64de3a1

SHA256
3cfcc1b68aaacea6eb5b157d33d226ff58e3baeedb1bdb939a2321993894611b

SHA512
872385b6c211aded214b2ead0eb8bec4b4f8e38ead65b6a7e6ce2d9e87f49a85789a96360642cfbc5201adc6b084db30d64b9190e74aa7cba0da88fec165d691

Download Submit
C:\Windows\TEMP\{1CA3B~1\xvdd.cat

Filesize
11KB

MD5
af3c920c92f0688febb19b4805200d4f

SHA1
c35515e4798f560e217ed9208881156b4606b4fd

SHA256
a7d560904523a020f5c2ab82632b3a91692a2bbfb7ce06bd9bbc0cb9fb1949dc

SHA512
a51aaa6d260cb54cd30f7a80d95a1f0d3919f203627d8eaeec6422c70520adee6455f6c0cc2dac468a3e389846b6337673dad937eacb4ab8f73fda4ffbd245b8

Download Submit
C:\Windows\TEMP\{1CA3B~1\xvdd.sys

Filesize
651KB

MD5
da35554449881ab09f3692b4f920bc84

SHA1
97ca96471c153404a303835b931e8f9fdeaacbdd

SHA256
a7f1fceb672356038d63f1658ed7ab700b300ef2c389fe1e96cd169a0a448c53

SHA512
91e4c7aab14327f7581c5f1c238a8533ff366897c80437d94265b8ae6b400e311c30da5997e471d75dce0a7c578d740072da2582b416147535859b3d512607e6

Download Submit
C:\Windows\TEMP\{1ca3b0e7-42db-7446-8ca4-514c8bf81331}\xvdd.inf

Filesize
1KB

MD5
a91b525f9686fe6c3bb30ac95c1928e1

SHA1
dcda9b4ebf7a2c024518292a44a07639179dc220

SHA256
bd5c2632d4d29645debdbc51238bd5de6b4fba5d30fb2a346ede60713ec6f01b

SHA512
ed933cc1db3c29dbb57de8ca44ae162f012d4820cf5e836a588fd9dc8dc959c03b1ac0fe9569a89ab16ef5af30862882aa2504d1f7838ea16c3a7c37c4098628

Download Submit
C:\Windows\TEMP\{FCA8B~1\gameflt.cat

Filesize
11KB

MD5
2b0aef3f4efd549637bfe7091c813ddc

SHA1
65b8d07bded90a4f9bdde04981cd5f86e741421e

SHA256
8d75f1481d117755f9d7fd44ce14a1f5dfae46a1c1cde7162a93eb4ad21443f2

SHA512
c6be56cdf131496e819798fa0fc21bb04e2224c6c84809ae0f9a0197b104b99e7729eaa486eed1d67044743798c2991182efd68d27366a18121f97adaa8c3c5c

Download Submit
C:\Windows\TEMP\{FCA8B~1\gameflt.sys

Filesize
139KB

MD5
5b7b08550e6301040c9f44944ba40e52

SHA1
0630f4a65932232bf63d9261b1013f355bc78d8e

SHA256
b138b2b591cf030604976d33c010ff2d5b845b265c6c8c0507b7beb0b49e6c59

SHA512
9f8bad98a9e6cf46ea977638a3e2827c4d14b263f4dadd6f3d91303d618b80429fd67ef00388b2c324ad334e7fb4d73527e27a5fb28317b5971098449ab8f02e

Download Submit
C:\Windows\TEMP\{fca8b498-6864-b847-9546-4a85ee7d97e8}\gameflt.inf

Filesize
2KB

MD5
887f0d14c8a2b33281ec31033ac35a0e

SHA1
26dcf1ea5e9cd19cbdbfffe49ff935c21159f94e

SHA256
7800b0f48e0fd1b17642307af27c89d1cbaeb199203455ee48b0ce178f090d6c

SHA512
3ed0046d46482d47f580c0265bd12c8421894c67a3c80e0db39c2452578654785e51d1315ecd98b2a1b83f387e9fd7ce51b626ab8c2ae04b68d637ffad161407

Download Submit
\??\c:\windows\system32\gameinputredist.dll

Filesize
361KB

MD5
ac7817f3bb39f7a1ecd79b22e55c7814

SHA1
6044b28135a7969959e601403aabd353bcfdb960

SHA256
68cd6170402ffc688e90e7e2ba81afe4c37fa8ca344763d3bfe7831ceb15cea7

SHA512
f464161c245c876400d286697eec7c268902249d202490be59f15aeaab1b1a9ba7cb7158695e0653b6505e8583365b0c61615570a979dae04d1f374ab12490f0

Download Submit
memory/428-1565-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/428-1560-0x0000000006A60000-0x0000000006A70000-memory.dmp

Filesize
64KB

Download
memory/428-1559-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/3140-990-0x000001FF31E40000-0x000001FF31E50000-memory.dmp

Filesize
64KB

Download
memory/3140-974-0x000001FF31D40000-0x000001FF31D50000-memory.dmp

Filesize
64KB

Download
memory/3140-1006-0x000001FF3A190000-0x000001FF3A191000-memory.dmp

Filesize
4KB

Download
memory/3140-1008-0x000001FF3A1C0000-0x000001FF3A1C1000-memory.dmp

Filesize
4KB

Download
memory/3140-1009-0x000001FF3A1C0000-0x000001FF3A1C1000-memory.dmp

Filesize
4KB

Download
memory/3140-1010-0x000001FF3A2D0000-0x000001FF3A2D1000-memory.dmp

Filesize
4KB

Download
memory/3880-1523-0x0000000006080000-0x0000000006090000-memory.dmp

Filesize
64KB

Download
memory/3880-1522-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/3880-1524-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4184-1564-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4184-1563-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/5180-2454-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/5180-2452-0x00000000064A0000-0x00000000064B0000-memory.dmp

Filesize
64KB

Download
memory/5180-2451-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/6076-466-0x0000000000C90000-0x0000000001B14000-memory.dmp

Filesize
14.5MB

Download
memory/6076-469-0x0000000006A50000-0x0000000006A76000-memory.dmp

Filesize
152KB

Download
memory/6076-465-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/6076-529-0x00000000169A0000-0x00000000169A8000-memory.dmp

Filesize
32KB

Download
memory/6076-541-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/6076-542-0x00000000069D0000-0x00000000069E0000-memory.dmp

Filesize
64KB

Download
memory/6076-543-0x0000000009700000-0x0000000009708000-memory.dmp

Filesize
32KB

Download
memory/6076-544-0x00000000069D0000-0x00000000069E0000-memory.dmp

Filesize
64KB

Download
memory/6076-579-0x00000000069D0000-0x00000000069E0000-memory.dmp

Filesize
64KB

Download
memory/6076-467-0x00000000069D0000-0x00000000069E0000-memory.dmp

Filesize
64KB

Download
memory/6076-468-0x00000000069C0000-0x00000000069CA000-memory.dmp

Filesize
40KB

Download
memory/6076-511-0x000000000C500000-0x000000000C50E000-memory.dmp

Filesize
56KB

Download
memory/6076-510-0x000000000C540000-0x000000000C578000-memory.dmp

Filesize
224KB

Download
memory/6076-528-0x0000000016D20000-0x0000000016D42000-memory.dmp

Filesize
136KB

Download
memory/6076-470-0x00000000069D0000-0x00000000069E0000-memory.dmp

Filesize
64KB

Download
memory/6076-502-0x00000000069D0000-0x00000000069E0000-memory.dmp

Filesize
64KB

Download
memory/6076-1292-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/6380-1561-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/6380-1562-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/6412-2447-0x00007FFD08ED0000-0x00007FFD08F47000-memory.dmp

Filesize
476KB

Download
memory/6412-2448-0x00000224FD610000-0x00000224FD71A000-memory.dmp

Filesize
1.0MB

Download
memory/6512-1426-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/6512-1427-0x0000000005F00000-0x0000000005F10000-memory.dmp

Filesize
64KB

Download
memory/6512-1428-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/6588-2811-0x00007FFD06340000-0x00007FFD063B7000-memory.dmp

Filesize
476KB

Download